CVE-2008-3655: High severity ruby vulnerability
Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not properly restrict access to critical variables and methods at various safe levels, which allows context-dependent attackers to bypass intended access restrictions via (1) untracevar, (2) $PROGRAMNAME, and (3) syslog at safe level 4, and (4) insecure methods at safe levels 1 through 3.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2008-3655?
CVE-2008-3655 is considered a medium severity vulnerability due to the potential for context-dependent attackers to bypass access restrictions.
How do I fix CVE-2008-3655?
To resolve CVE-2008-3655, it is recommended to upgrade Ruby to a version later than 1.8.7-p71 where the vulnerability has been addressed.
What versions of Ruby are affected by CVE-2008-3655?
CVE-2008-3655 affects Ruby versions up to and including 1.8.7-p71 as well as earlier versions like 1.8.5 and 1.9 up to r18423.
What impact does CVE-2008-3655 have on Ruby applications?
CVE-2008-3655 allows attackers to bypass intended access restrictions, which may lead to unauthorized access to critical variables and methods in Ruby applications.
Is there a workaround for CVE-2008-3655?
There are no known effective workarounds for CVE-2008-3655, so upgrading to a patched version of Ruby is the only solution.